Every CVE Search/ Get API key

CVE-2021-21412

[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values

6.4 MediumFix available

Potential for arbitrary code execution in npm package @thi.ng/egf #gpg-tagged property values (only if decrypt: true option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for #gpg-tagged values in the EGF source file/string and check for backtick (`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.34%Down 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.4

[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values

Potential for arbitrary code execution in npm package @thi.ng/egf #gpg-tagged property values (only if decrypt: true option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for #gpg-tagged values in the EGF source file/string and check for backtick (`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present.

Record
CVE-2021-21412
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2021-0870 6.4

Potential for arbitrary code execution in npm package @thi.ng/egf #gpg-tagged property values (only if decrypt: true option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for #gpg-tagged values in the EGF source file/string and check for backtick (`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present.

Record
EUVD-2021-0870
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-rj44-gpjc-29r7 6.4

[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values

Impact

Potential for arbitrary code execution in #gpg-tagged property values (only if decrypt: true option is enabled)

Patches

A fix has already been released as v0.4.0

Workarounds

By default, EGF parse functions do NOT attempt to decrypt values (since GPG is only available in non-browser env).

However, if GPG encrypted values are used/required:

  1. Perform a regex search for #gpg-tagged values in the EGF source file/string and check for backtick (`) chars in the encrypted value string
  2. Replace/remove them or skip parsing if present...

References

https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7#advisory-comment-65261

For more information

If you have any questions or comments about this advisory, please open an issue in the thi.ng/umbrella repo, of which this package is part of.

Record
GHSA-rj44-gpjc-29r7
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-78
Updated
2026-11-02
NVD 6.4

Potential for arbitrary code execution in npm package @thi.ng/egf #gpg-tagged property values (only if decrypt: true option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for #gpg-tagged values in the EGF source file/string and check for backtick (`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present.

Record
CVE-2021-21412
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-78
Updated
2026-11-02
OSV 8.8

Potential for arbitrary code execution in npm package @thi.ng/egf #gpg-tagged property values (only if decrypt: true option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for #gpg-tagged values in the EGF source file/string and check for backtick (`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present.

Record
CVE-2021-21412
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-rj44-gpjc-29r7 6.4

[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values

Impact

Potential for arbitrary code execution in #gpg-tagged property values (only if decrypt: true option is enabled)

Patches

A fix has already been released as v0.4.0

Workarounds

By default, EGF parse functions do NOT attempt to decrypt values (since GPG is only available in non-browser env).

However, if GPG encrypted values are used/required:

  1. Perform a regex search for #gpg-tagged values in the EGF source file/string and check for backtick (`) chars in the encrypted value string
  2. Replace/remove them or skip parsing if present...

References

https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7#advisory-comment-65261

For more information

If you have any questions or comments about this advisory, please open an issue in the thi.ng/umbrella repo, of which this package is part of.

Record
GHSA-rj44-gpjc-29r7
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-78
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@thi.ng/egf
npm
 before 0.4.0
0.4.0

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21412 is a medium vulnerability (CVSS 6.4) in Thi-ng Egf, published March 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in @thi.ng/egf 0.4.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open